Inline Deployment

With an inline deployment, emails are thoroughly examined before it reaches a recipient’s inbox. Email Gateway Defense becomes a step in the SMTP processing sequence and actively engages with incoming email messages. Based on your policies, various messages are blocked before reaching the inbox.

Benefits

An inline deployment provides customers with layered security and filtering. Filtering messages in a gateway helps to ensure that malicious emails are never delivered. Finally, an API integration with Barracuda Impersonation Protection provides post-delivery detection and protection.

Another benefit to inline deployment is the ability to improve email security without depending on changes to DNS MX records. This is particularly helpful when various teams manage different aspects of your organization.

Limitations

Inline deployments are not without disadvantages. For example, email continuity and spooling are not available. Additionally, SPF and DMARC checks, RBL checking, and rate control are not available.

Getting Started

The following sections detail how to configure Email Gateway Defense and add mail flow rules and connectors to route emails.

Configure Email Gateway Defense

1. Log into your Barracuda Cloud Control account, and click Email Gateway Defense in the left pane.

2. In the Email Gateway Defense wizard, enter a valid email address from the email server domain you want to protect with Email Gateway Defense. Click Detect email server.
   The system automatically auto-fills your destination mail server.
   

   

3. Click Save and Exit to exit the wizard.

4. Verify your domain by sending an email to postmaster@domain.com.

5. On the Domains page, click Edit. Under Mail Servers, click Add Mail Server and enter your mail server.

6. On the Domains page, note the primary and backup MX records. You will need this when setting up mail flow rules in Exchange.

   

   Note that a warning message such as “MX records are misconfigured” will appear on the Domains page and can be ignored.

7. Go to the Inbound Settings > IP Address Policies page. Using Bulk Edit, add the following Microsoft365 Exchange Online IP address ranges as Trusted Forwarders. These are subject to change based on Microsoft.

   40.92.0.0,255.254.0.0,Office365 
   40.107.0.0,255.255.0.0,Office365 
   52.100.0.0,255.252.0.0,Office365 
   104.47.0.0,255.255.128.0,Office365 

   For more information, see the Microsoft article https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide#exchange-online..

Your initial configuration of Email Gateway Defense is complete.

Set Up Exchange Online

This inline deployment option is a separate set up from Step 2 - Configure Microsoft 365 for Inbound and Outbound Mail. Choose only one of the options when setting up Email Gateway Defense.

Set Up a New Outbound Connector From Microsoft 365 to Barracuda Networks

Set Up a New Inbound Connector From Partner to Microsoft 365

Create a partner connector to establish a secure connection between Barracuda and Microsoft servers when receiving processed mail by Barracuda Networks.

Set Up Mail Flow Rules

Before setting up the mail flow rules, create a secret value. This will be used in the mail flow rules and will ensure mail is always scanned by Email Gateway Defense. For example, you can use openssl rand -hex 32 to create a 256-bit secret key. Ensure that the key is US ASCII characters only since it will be used in an email header. You can also use this link to create the secret key https://www.cryptool.org/en/cto/openssl/.

1. Log into the Microsoft 365 admin center https://admin.exchange.microsoft.com/.

2. In the left pane, click mail flow, and click rules.

3. Click Add a rule.

4. Select Create a new rule.

5. In the new rule page, enter a Name to represent the rule. For example, Forward to Barracuda Networks unless secret header is present.

6. Under Apply this rule if, select Apply to all messages.

7. Under Do the following:

   1. Select Redirect the message to > the following connector, and select the connector you defined above in Set Up a New Inbound Connector.

   2. Select Modify the message properties > set a message header X-BARRACUDA-SECRET to the value <your-secret-key>.

8. Under Except if:

   1. Select A message header > matches these text patterns X-BARRACUDA-SECRET matches <your-secret-key>.

   2. Select The sender > IP address is in any of these ranges or exactly matches <your Email Gateway Defense region>. To find your Email Gateway Defense region, see Email Gateway Defense Outbound IP Ranges.

9. Click Save.

10. On the Set rule settings page, set the Priority to 0, Severity to High, and check Stop processing more rules.

11. Click Next. Review the settings and then click Finish.

12. Create another new rule and name it Remove Barracuda header secret from scanned emails.

13. Under Apply this rule if, select A message header > matches these text patterns X-BARRACUDA-SECRET matches <your-secret-key>.

14. Under Do the following, select Modify the message properties > remove a message header X-BARRACUDA-SECRET.

15. On the Set rule settings page, set the Priority to 1, Severity to High. Ensure Stop processing more rules in unchecked.

16. Click Next. Review the settings and then click Finish.